4 ms·
Admittedly that's all happening with javascript passthrough to stripe's API using https.
by thebeardisred 12y ago
Admittedly that's all happening with javascript passthrough to stripe's API using https.
- gameguy43 12y agoThis. I added https to my site to get users to stop worrying, but AFAIK you don't need it with Stripe.
- scott_karana 12y agoUgh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies. What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself? EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed: Do I need to use SSL/TLS on my payment pages? Yes, for a couple of reasons: * It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. * Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too. 1 https://stripe.com/help/ssl https://stripe.com/help/ssl
- mholt 12y agoI think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to an attacker. HTTPS is a 100% must on all pages for a business.